You could look in the agent log on the target system – that would be a good start. Search the log for their role:username.
Some events are not tracked in agent logs.
For instance, some copy/paste operations done via the GUI are missing, I believe.
About NSH, you may want to enable keystroke logs, which keep track of any keys pressed by the user.